diff --git a/.github/workflows/patch-updater34-release.yml b/.github/workflows/patch-updater34-release.yml
new file mode 100644
index 0000000..e53bc1d
--- /dev/null
+++ b/.github/workflows/patch-updater34-release.yml
@@ -0,0 +1,62 @@
+name: Patch Updater 3.4 Release Provenance
+
+on:
+  push:
+    branches:
+      - feature/updater-3.4-lifecycle
+
+permissions:
+  contents: write
+
+concurrency:
+  group: patch-updater-34-release
+  cancel-in-progress: false
+
+jobs:
+  patch:
+    if: ${{ github.actor != 'github-actions[bot]' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: feature/updater-3.4-lifecycle
+          fetch-depth: 0
+
+      - name: Manifestvertrag auf Paket-Provenienz v2 erweitern
+        shell: python
+        run: |
+          from pathlib import Path
+
+          path = Path('tools/release-manifest-lib.mjs')
+          text = path.read_text(encoding='utf-8')
+
+          old = "import { createHash } from 'node:crypto';\n"
+          new = old + "import { computePackagePayloadHash, PACKAGE_MANIFEST_SCHEMA } from './updater-lifecycle-3.4.mjs';\n"
+          if text.count(old) != 1:
+              raise SystemExit('createHash-Import nicht eindeutig gefunden')
+          text = text.replace(old, new)
+
+          old = "  'scripts/updater/Vendoo.Updater.Worker.ps1',\n  'tools/apply-release-manifest.mjs',"
+          new = "  'scripts/updater/Vendoo.Updater.Worker34.ps1',\n  'tools/apply-release-manifest.mjs',\n  'tools/updater-lifecycle-3.4.mjs',\n  'tools/check-release-payload-3.4.mjs',"
+          if text.count(old) != 1:
+              raise SystemExit('alter Worker-Pflichtvertrag nicht eindeutig gefunden')
+          text = text.replace(old, new)
+
+          old = "  if (manifest.schema !== MANIFEST_SCHEMA) throw new Error(`Unbekanntes Manifest-Schema: ${manifest.schema}`);\n  if (manifest.mode !== 'overlay-with-explicit-removals') throw new Error(`Unzulässiger Release-Modus: ${manifest.mode}`);"
+          new = "  if (![MANIFEST_SCHEMA, PACKAGE_MANIFEST_SCHEMA].includes(manifest.schema)) throw new Error(`Unbekanntes Manifest-Schema: ${manifest.schema}`);\n  if (manifest.mode !== 'overlay-with-explicit-removals') throw new Error(`Unzulässiger Release-Modus: ${manifest.mode}`);\n  if (manifest.schema === PACKAGE_MANIFEST_SCHEMA) {\n    if (manifest.targetVersion !== manifest.version) throw new Error('targetVersion und version des Paketmanifests stimmen nicht überein.');\n    for (const field of ['sourceCommit', 'baseCommit']) {\n      if (!/^[a-f0-9]{40}$/.test(String(manifest[field] || ''))) throw new Error(`Ungültige Paket-Provenienz: ${field}`);\n    }\n    const createdAt = Date.parse(String(manifest.createdAt || ''));\n    if (!Number.isFinite(createdAt)) throw new Error('Ungültige Paket-Provenienz: createdAt');\n    if (!/^[a-f0-9]{64}$/.test(String(manifest.payloadHash || ''))) throw new Error('Ungültige Paket-Provenienz: payloadHash');\n    const expectedPayloadHash = computePackagePayloadHash(manifest);\n    if (manifest.payloadHash !== expectedPayloadHash) throw new Error('Payload-Hash des Paketmanifests stimmt nicht.');\n  }"
+          if text.count(old) != 1:
+              raise SystemExit('Schema-Prüfung nicht eindeutig gefunden')
+          text = text.replace(old, new)
+
+          path.write_text(text, encoding='utf-8', newline='\n')
+
+      - name: Patch committen und temporären Workflow entfernen
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -f .github/workflows/patch-updater34-release.yml
+          git config user.name 'vendoo-updater-build'
+          git config user.email 'vendoo-updater-build@users.noreply.github.com'
+          git add --all
+          git commit -m 'feat: validate updater 3.4 package provenance'
+          git push origin HEAD:feature/updater-3.4-lifecycle